What Advisors Can Learn From the Sony Hack

If data were stolen with an eye toward controlling a company or the supply chain, terrorism coverage, rather than cyber coverage, may be what is needed. But finding coverage is hard.

Aaron Davis, managing director of operations and property practice at Aon Risk Solutions, said catastrophic balance sheet protection for many companies is tight. "It's a very, very tough risk to place compared to appetite, even with TRIA in place."

Kalinich said a cyber policy is intended to cover unauthorized privacy and security incidents, but most have exclusions for war and terrorism. In the absence of terrorism insurance, "if you shop around to different carriers," he said, "you can negotiate to carve back the terrorism exclusion" so that the policy includes that coverage.

So how can companies, yours included, better protect themselves—particularly in the absence of terrorism insurance? Kalinich said that first, "even before you get to insurance, entities need to take inventory of their assets, [both] tangible and intangible, such as information, trade secrets, intellectual property. How could these assets be impacted? What would happen if there was a breach or shutdown or extortion? Categorize assets and prioritize [them] in value."

Second, companies should check their existing policies for coverage. Underwriting is complicated for terrorism risk, even with a TRIA backstop. "This is an important issue that has not been addressed," Kalinich said. "Now companies are becoming aware that cyber terrorism can affect mainstream companies."

An enterprise risk management policy could be the answer. The issue itself is at the macro level, he said—a board of directors issue, a fiduciary issue—and there are no one-size-fits-all answers.